Been trying for ages now, and it seems like its not just the IPs from bbc.co.uk and bbci.co.uk - there are subsequent connections triggered that appear to go to random non bbc domains (edigitalsurvey, iperceptions etc). Has anyone got this working?
Objective is to properly capture all the IPs into a dst-adrslist for marking, then subsequent tunneling. This would enable transparent iPlayer use from my LAN from any device, while leave all non iPlayer traffic alone.